[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #12999 [Tor Browser]: Use one clock skew per URL bar domain

#12999: Use one clock skew per URL bar domain
--------------------------------+------------------------------------------
     Reporter:                  |      Owner:  tbb-team
  arthuredelstein               |     Status:  new
         Type:  enhancement     |  Milestone:
     Priority:  normal          |    Version:
    Component:  Tor Browser     |   Keywords:  tbb-fingerprinting-time-skew
   Resolution:                  |  Parent ID:
Actual Points:                  |
       Points:                  |
--------------------------------+------------------------------------------
Changes (by mikeperry):

 * parent:  #3059 =>


Comment:

 One thing that Arthur and I discussed today was adding some kind of RELAY
 cell command to obtain the current time from the exit. In retrospect, this
 also seems bad, because the exit could use this to lie to you about the
 current time to get you to accept an expired or invalid SSL cert, or to
 generally cause havock on your notion of time for a webapp.

 Another option is to periodically run tlsdate-style time lookups using a
 helper app independent from Tor, and use that for time. I think this may
 actually be the sanest approach.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12999#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs